Full Breakdown
Israeli Ad Firm’s Global Spy Campaign Exposed
By Drooid · · How we work
Core Operation: Advertising Network Used to Deploy Spyware
On October 15, 2026, Reuters reported that Israeli digital-ad agency Discover-Tech ran a network of online ads that could identify visitors, track devices and, in some cases, deliver malicious code. Its platform—named Controlium in the research—allowed third-party spyware firms to “mass-profile and deanonymise” users before silently installing “zero-click” spyware that required no interaction.
Scale and Technical Details
Discover-Tech’s ads appeared on more than 120,000 websites and 75,000 apps, reaching an estimated 10 million ads per day worldwide. Researchers said the ads could extract phone numbers and, through “cookie-matching,” follow users beyond the immediate placement. Authentication logs exposed online showed logins from IP addresses in Israel, Europe and the Gulf, indicating a geographically dispersed operator base.
Targeted Entities and Notable Infections
Citizen Lab confirmed that a “powerful form” of Candiru spyware—an Israeli product blacklisted by the U.S. Commerce Department in 2021—was delivered via Discover-Tech ads to 45 Windows devices at Qatari broadcaster Al Jazeera during 2024-2025. Additional evidence showed malicious ads shown to users in networks associated with the Pentagon, IAEA, ICC, UN, NATO, the European Commission, and several national governments, as well as semiconductor firms such as Nvidia, SanDisk, Broadcom and Micron.
Industry Response and Platform Bans
Following the investigation, several ad-tech platforms took action:
- Google removed Discover-Tech from Google Ads for “systematically violating our policies.”
- IAB Europe suspended the firm from its list of globally approved vendors after an audit identified violations.
- Comcast’s ad-tech subsidiary Beeswax removed the firm from its platform “following recent activity.”
These steps reflect a growing recognition that online-ad ecosystems can be weaponised for espionage. Earlier in the year, the U.S. Pentagon reported that U.S. forces in war zones had been targeted using location data harvested by ad-tech firms and data brokers, underscoring the national-security dimension.
Recommendations and Expert Commentary
Security researchers stress that traditional ad-blocking tools are insufficient against sophisticated “malvertising” campaigns. They advise users to disable advertising IDs on mobile devices, employ opt-out features in apps, and consider broader defensive measures such as resetting or disabling device identifiers.
Verbatim Quotes
- “The way online advertising works today is a systemic security threat,” — Wolfie Cristl, Citizen Lab senior researcher
- “Any time we browse the internet or open an app, all the data on our device can be hacked by malicious actors without us even knowing,” — Natalia Krapiva, spyware expert at Access Now